1. Who controls your personal data?
Travel Mood is owned and operated by Bold CX Ltd, company number 14372931, of C/o Argyle House, 3rd Floor Northside, Joel Street, Northwood Hills, Middlesex, HA6 1NW, United Kingdom (“Bold CX”, “we”, “us”). Bold CX is the controller responsible for the personal data described in this notice.
2. What data do we collect from you?
- Account and profile data: name, email address, authentication identifiers, profile image, home airport, preferred currency, language, timezone and communication choices.
- Planning data: travel moods, prompts, destinations, dates, budgets, preferences, itineraries, refinements, wishlists, saved places and map selections.
- Trip and collaboration data: trips, invitations, buddy and family relationships, participant information, shared expenses and settlement calculations.
- Traveller data: details you choose to save for yourself or another traveller, which may include names, dates of birth, nationality, document details, loyalty memberships, dietary needs, accessibility information and emergency information.
- Booking and concierge data: external booking records, supplier references, searches, selected offers, requests, messages, proposals, payments, refunds and permitted attachments.
- Membership data: plan, subscription status, billing-provider references, AI-credit allowances, usage events, referral attribution and promotional or administrator-granted access.
- Communications: support and contact messages, feedback, invitation activity, notification preferences and optional files you submit.
- Technical data: device, browser, app version, IP address, request logs, session and security information needed to operate, diagnose and protect the Service.
Passport images submitted to the scanner are used as transient extraction inputs. Travel Mood saves only the fields you review and choose to keep, not the source passport image.
3. What data do we receive from other sources?
We may receive information from a person who invites you to a trip or family group, a traveller on whose behalf a user acts, payment and app-store providers, travel-data and booking suppliers, mapping providers, authentication services, and service providers that report delivery, security or transaction status. The information depends on the feature used and may include contact details, invitation context, subscription status, supplier offer or booking information and service events.
4. Why do we process your data and on which basis?
- To perform our contract with you: create and secure your account; provide planning, itinerary, collaboration, membership, booking-record and concierge features; process payments; and deliver requested communications.
- To take steps at your request before a contract: respond to enquiries, show plan information, search supplier availability and assess concierge requests.
- For our legitimate interests: protect against misuse and fraud, diagnose faults, maintain service reliability, understand account-level feature operation, answer support requests and improve the Service where those interests are not overridden by your rights.
- With consent: send optional marketing, use device permissions such as push notifications, and process information where consent is the appropriate legal basis. You may withdraw consent at any time.
- To comply with legal obligations: keep required financial, security and transaction records and respond to valid legal requests.
5. Who processes or receives your data?
Authorised Bold CX personnel and contractors may process personal data where needed and are subject to confidentiality and access controls. We also use service providers and disclose data to them only for the relevant purpose:
- Supabase: authentication, database and application-data services.
- Google AI: requested itinerary generation and refinement using the brief and trip context submitted for that action.
- Google Maps Platform and Places: place discovery, map display, location details and place media.
- Stripe: web checkout, subscription management and eligible payment events. We do not store full payment-card details.
- RevenueCat and applicable app stores: mobile purchase and entitlement management where mobile subscriptions are offered.
- Resend: transactional account, invitation, service and support email delivery.
- Travel-data and supplier services, including Duffel and Hotelbeds where enabled: flight, hotel or activity search and supplier-related request data.
- Replit and infrastructure providers: application hosting, secure service operation and storage.
Trip data is visible to people with whom the relevant trip is shared. Family organisers and members receive the access shown in the product. Concierge information is available to authorised support personnel and may be shared with a relevant supplier where necessary to assess or fulfil a request. A supplier may act as an independent controller under its own privacy notice.
6. International transfers
Some providers process data outside the United Kingdom or European Economic Area. Where required, we use recognised safeguards such as adequacy regulations, the UK International Data Transfer Agreement or Addendum, European Commission standard contractual clauses, or another lawful transfer mechanism.
7. How long do we retain your data?
- Account and active-service data is generally retained while your account remains open.
- If you delete your account, data is deleted or anonymised subject to backup cycles and records we must retain for legal, tax, security, fraud-prevention, dispute or financial purposes.
- Subscription, payment, refund and accounting records are retained for the period required by applicable law.
- Support, concierge and booking records are retained while needed to provide the service and for a reasonable period afterwards to handle complaints, legal claims and supplier reconciliation.
- Private concierge identity attachments expire after 24 hours. Contact-form attachments are delivered for support without being retained in Travel Mood application storage.
- Guest planning data stored in the browser expires or is removed as described in the Cookies Notice.
8. Security
We use technical and organisational measures intended to protect personal data, including authenticated access, role-based controls, encrypted transport, private-file controls and restricted staff access. No internet service is completely secure, and you are responsible for protecting your account credentials and devices.
9. Your choices and rights
You may ask us to:
- tell you whether we process your personal data and provide a copy;
- correct inaccurate or incomplete data;
- delete data in applicable circumstances;
- restrict or object to certain processing;
- provide data you supplied in a portable format where the right applies;
- withdraw consent where processing relies on consent; and
- review a decision where applicable law provides a right relating to solely automated decision-making.
You can manage profile and traveller details, sharing relationships, communication consent and certain device permissions in the Service. Marketing choices are separate from transactional service communications. You can permanently delete your account from the profile settings after explicit confirmation.
10. How to exercise your rights
Contact Bold CX through the Contact us page and clearly describe your request. We may need to verify your identity. We normally respond within one month, subject to extensions permitted by law. You also have the right to complain to the UK Information Commissioner’s Office or, where applicable, your local data-protection authority.
11. Browser and mobile data
The web application stores authentication state and short-lived or functional values such as a guest planning handoff, pending referral, dismissed notices and interface state. The mobile app may store app data on the device and request operating-system permissions only where a feature needs them. See the Cookies Notice for details.
12. Changes to this notice
We may update this notice to reflect changes to Travel Mood, our providers or the law. The date above identifies the latest version. Where required, we will provide additional notice of a material change.